Initial commit: Imperva WAF demo lab

Flight-booking app scaffolded from the source running on the GCP host,
plus the four-screen frontend and three OWASP attack endpoints (SQLi,
reflected XSS, path traversal) built and locally verified against a
live uvicorn/vite dev pair. Includes deploy.sh (local build -> ship
over ssh -> swap on host) and docs/ carried over from the handoff.

imperva-proxy/Caddyfile

@@ -0,0 +1,15 @@
+{
+	auto_https off
+}
+
+:443 {
+	tls /etc/caddy/certs/origin.crt /etc/caddy/certs/origin.key
+
+	handle /api/* {
+		reverse_proxy host.containers.internal:8000
+	}
+
+	handle {
+		reverse_proxy host.containers.internal:8080
+	}
+}

imperva-proxy/certs/origin.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDOjCCAiKgAwIBAgIUXT8uwyaJMEENfQOgs6SsXZ4W+C0wDQYJKoZIhvcNAQEL
+BQAwGzEZMBcGA1UEAwwQZmx5dG9vdXRlci5zcGFjZTAeFw0yNjA3MjgyMDAyNTRa
+Fw0zNjA3MjUyMDAyNTRaMBsxGTAXBgNVBAMMEGZseXRvb3V0ZXIuc3BhY2UwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3gl823XO7+Qx09H0rHoocm/YE
+NeUYXFtWLevhptFYOpoyU+EafsogrHMJO9dy0Tnt/sA6dv+Td7oF4BxrJykbr6Fh
++xGonXGck/vTh7RE4eNClmQBZ7jJrMN0BhCtw+gvmUVgzNAz2ItqoCs37fX2EC6+
+AcApAbWIAnNmNoKa7Sc6CL+uGm6I3eW769J72rDxhm27ZUtFZZTxF8jhc64kR6TM
+TDSAMLt2axlUHsYZ4GdLjsJ47rb461Cn9smUX4SFD74qSNmYDPzZbBgvmi+/UkC7
+lFsT+6FwYP/wc3eRVjVhb6j1mjG/UiVwYY59eUoKbN1Ebl/XpvJHs4skxqwLAgMB
+AAGjdjB0MB0GA1UdDgQWBBTEJ04zRuHst5AwwW32lpBe43YONzAfBgNVHSMEGDAW
+gBTEJ04zRuHst5AwwW32lpBe43YONzAPBgNVHRMBAf8EBTADAQH/MCEGA1UdEQQa
+MBiCEGZseXRvb3V0ZXIuc3BhY2WHBCPLkywwDQYJKoZIhvcNAQELBQADggEBAGAH
+EkzsBrSa30386HeOLChmbgIeCIDQLtfwPSgMtTunWTHG5fsDWIMoOOYEWT/dZdwj
+8pw7FbvkKYDbnU8QufP3v+qyfvgsvAlQ9Is5+E9eTm0mmBi/zQBBZCe+vzF1EfMp
+xHcvsuVwoDgaQ39Tk6rzERjpr2oIhf6UL4IFc7xP8/vmyUaIzFffxuFXMuheqGnv
+uDqV+HxsJbaQnbqfRGxHmEoXNz4YhuUvT1qFgh0aeB/PDgr1T7gGvP/nrfJ0gA6D
+Tvk7xnjWCeo+aKvHO6ZNqCrLqJbi5MgitdEQ5GYX4PGRH4xay9fpGlwP47oqS5Gn
+XxFeG/YP/3uKDgjBOSE=
+-----END CERTIFICATE-----